cco/cybertools
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

HTML sanitizing: allow specification of parts of style names

Browse source 
git-svn-id: svn://svn.cy55.de/Zope3/src/cybertools/trunk@3573 fd906abe-77d9-0310-91a1-e0d9ade77398
This commit is contained in:
helmutm 2009-10-09 09:04:21 +00:00
parent eb89194421
commit 6eba456319
1 changed files with 14 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
util/html.py
View file

@ -24,13 +24,13 @@ $Id$
from cybertools.text.lib.BeautifulSoup import BeautifulSoup, Comment from cybertools.text.lib.BeautifulSoup import BeautifulSoup, Comment
#validTags = 'p i strong b u a h1 h2 h3 img pre br'.split() validTags = ('b br div em font h1 h2 h3 i li ol p pre span strong '
validTags = 'b br div em font h1 h2 h3 i p pre span strong table td tr u'.split() 'table td tr u ul').split()
#validAttrs = 'href src'.split()
validAttrs = 'class style'.split() validAttrs = 'class style'.split()
validStyles = 'font-style font-weight'.split() validStyles = 'font-style font-weight'.split()
validStyleParts = 'border padding'.split()
def sanitize(value, validTags=validTags, validAttrs=validAttrs, def sanitize(value, validTags=validTags, validAttrs=validAttrs,
@ -43,6 +43,7 @@ def sanitize(value, validTags=validTags, validAttrs=validAttrs,
tag.hidden = True tag.hidden = True
attrs = [] attrs = []
for attr, val in tag.attrs: for attr, val in tag.attrs:
attr = attr.lower()
if attr not in validAttrs: if attr not in validAttrs:
continue continue
if attr == 'style': if attr == 'style':
@ -58,6 +59,15 @@ def sanitizeStyle(value, validStyles=validStyles):
for item in value.split(';'): for item in value.split(';'):
if ':' in item: if ':' in item:
k, v = item.split(':') k, v = item.split(':')
if k.strip() in validStyles: if checkStyle(k):
result.append(item.strip()) result.append(item.strip())
return '; '.join(result) return '; '.join(result)
def checkStyle(k):
k = k.strip().lower()
if k in validStyles:
return True
for name in validStyleParts:
if k.startswith(name):
return True
return False